Security everywhere digital signature and digital fingerprint v1 (personal)

Editor's Notes

• #3: 在就例 我們列出 今日的學習目標 Besides, 今天 我們的內容 是以 比較生活化的方式來進行講解 無可避免的 在座如果有一些 對 security 以早有研究的先進 可能會想了解更詳細的內容 , 如演算法 及數學的求證 或者是攻擊者 how to attack , 及你要如何 defense 這些 threat 我們可以折日 在更 advance 的課程 來滿足各位的需求 麻煩
• #5: Why I said Security is everywhere … . We firstly check our physical realm out …
• #6: 講到 security , 必然一定要提到 其 4 大特性 還有程度的差異 The transmitted message must make sense to only the intended receiver -- Privacy Receiver needs to be sure of the sender’s identity – Authentication Data must arrive at the receiver exactly as they were sent – Integrity Receiver must prove that a received message came from a specific sender -- Non-repudiation
• #7: 護照 是一個 國家 的政府发放給本國 公民 （ citizen ）或 國民 （ national ）的一種旅行 证件 ，用於證明持有人的 身分 與 國籍 ，以便其出入本國及在外國旅行，同時亦用於請求有關外國當局給予持照人通行便利及保護。 護照關係到在國外所受合法保護的權利與進入本籍國的權利。护照上通常有持有者的照片、签名、出生日期、国籍和其它个人身分的证明。许多国家正在開發將 生物识别 技术用於護照，以便能够更精确地确认护照的使用者是其合法持有人。 如今国际间旅行通常要求出示护照 , 但也有例外的情况。护照实际上仅仅是一种国际认可的用来对旅行者身份鉴定的手段。而这样的鉴定要求在很多情况下或针对某些旅行者可以免除。例如现在 美国 公民凭驾照即可进入 墨西哥 ，而 欧盟 国民在欧盟内部旅行也不需要护照。 同样的，护照在一个国家内部也可以被当成身份证件而使用。
• #8: 由 喬納森·莫斯托 拍攝並於 2000 年上映的電影 U-571 講的是一群美國潛艇兵為繳獲一台恩尼格瑪機而搶了一艘德國潛艇後的故事
• #9: 小組成員調查神秘與不尋常的死因，以判定是誰以及如何殺了他們。成員們也會解決一些其他的重罪，例如強姦罪的採證，但這個系列影集的主題仍以謀殺案件為主。 Criminalistics is the application of various sciences to answer questions relating to examination and comparison of biological evidence , trace evidence , impression evidence (such as fingerprints , footwear impressions, and tire tracks), controlled substances , ballistics , firearm and toolmark examination, and other evidence in criminal investigations. Typically, evidence is processed in a crime lab . Digital forensics is the application of proven scientific methods and techniques in order to recover data from electronic / digital media. DF specialists work in the field as well as in the lab. Forensic anthropology is the application of physical anthropology in a legal setting, usually for the recovery and identification of skeletonized human remains. Forensic archaeology is the application of a combination of archaeological techniques and forensic science, typically in law enforcement. Forensic DNA analysis takes advantage of the uniqueness of an individual's DNA to answer forensic questions such as determining paternity/maternity or placing a suspect at a crime scene. Forensic entomology deals with the examination of insects in, on, and around human remains to assist in determination of time or location of death. It is also possible to determine if the body was moved after death. Forensic geology deals with trace evidence in the form of soils, minerals and petroleums. Forensic interviewing is a method of communicating designed to elicit information and evidence. Forensic meteorology is a site specific analysis of past weather conditions for a point of loss. Forensic odontology is the study of the uniqueness of dentition better known as the study of teeth. Forensic pathology is a field in which the principles of medicine and pathology are applied to determine a cause of death or injury in the context of a legal inquiry. Forensic psychology is the study of the mind of an individual, using forensic methods. Usually it determines the circumstances behind a criminal's behavior. Forensic toxicology is the study of the effect of drugs and poisons on/in the human body. Forensic document examination or questioned document examination answers questions about a disputed document using a variety of scientific processes and methods. Many examinations involve a comparison of the questioned document, or components of the document, to a set of known standards. The most common type of examination involves handwriting wherein the examiner tries to address concerns about potential authorship. Veterinary Forensics is forensics applied to crimes involving animals. Association of Firearm and Tool Mark Examiners Ballistic fingerprinting Computer forensics Crime Diplomatics (Forensic paleography) Forensic accounting Forensic animation Forensic anthropology Forensic chemistry Forensic engineering Forensic facial reconstruction Forensic identification Forensic materials engineering Forensic polymer engineering Forensic profiling Forensic psychology Questioned document examination Retrospective diagnosis Skid mark Trace evidence Profiling practices Testimony  · Documentary Physical  / Real  · Digital Exculpatory  · Scientific Demonstrative Eyewitness identification Genetic (DNA)  · Lies
• #28: Digital signing ensures that data originates from a specific party by creating a digital signature that is unique to that party. This process also uses hash functions. Put simply, digital signatures combine hashing (for the validation of the signature data) with asymmetric encryption for encoding that signature data. The following occurs when data is signed with a digital signature: A hash algorithm is applied to the data to create a hash value. The hash value is encrypted with User A’s private key, thereby creating the digital signature. The digital signature and the data are sent to User B. The following occurs when digitally signed data is decrypted: User B decrypts the signature by using User A’s public key and then recovers the hash value. If the signature can be decrypted, User B knows that the data came from User A (or the owner of the private key). The hash algorithm is applied to the data to create a second hash value. The two hash values are compared. If the hash values match, User B knows that the data has not been modified.
• #30: In a public key environment, it is vital that you are assured that the public key to which you are encrypting data is in fact the public key of the intended recipient and not a forgery. You could simply encrypt only to those keys which have been physically handed to you. But suppose you need to exchange information with people you have never met; how can you tell that you have the correct key? Digital certificates, or certs, simplify the task of establishing whether a public key truly belongs to the purported owner. A certificate is a form of credential. Examples might be your driver's license, your social security card, or your birth certificate. Each of these has some information on it identifying you and some authorization stating that someone else has confirmed your identity. Some certificates, such as your passport, are important enough confirmation of your identity that you would not want to lose them, lest someone use them to impersonate you. A digital certificate is data that functions much like a physical certificate. A digital certificate is information included with a person's public key that helps others verify that a key is genuine or valid. Digital certificates are used to thwart attempts to substitute one person's key for another. A digital certificate consists of three things: A public key. Certificate information. ("Identity" information about the user, such as name, user ID, and so on.) One or more digital signatures. The purpose of the digital signature on a certificate is to state that the certificate information has been attested to by some other person or entity. The digital signature does not attest to the authenticity of the certificate as a whole; it vouches only that the signed identity information goes along with, or is bound to, the public key. Thus, a certificate is basically a public key with one or two forms of ID attached, plus a hearty stamp of approval from some other trusted individual.
• #32: PKI 是一種基礎建設內含對稱及非對稱性密碼學、軟體和網路服務的整合技術，主要是用來提供保障網路通訊和企業電子交易的安全性。 PKI 為一種支援數位憑證的軟體、標準和協定的安全性整合服務。 證管理中心 公開金鑰基礎建設 ，又稱公開金鑰基礎設施、公開金鑰基礎架構，簡稱公鑰基礎建設、公鑰基礎設施、公鑰基礎架構或 PKI 。 密碼學上，公開金鑰基礎建設藉著 憑證管理中心 （ CA ）將使用者的個人身分跟公開金鑰鏈結在一起。對每個憑證中心使用者的身分必須是唯一的，可能在人為監督下，合併使用分散於各地的其他協同軟體。對每個使用者，憑證中心發行的 公開金鑰憑證 含有不可偽造的個人身分、公鑰、有效條件與其他資料等。 可信賴的第三者（ Trusted third party ， TTP ）也長被用來指憑證中心。 PKI 有時被錯誤地拿來代表公開金鑰密碼學或公開金鑰演算法。 大部分企業級的公鑰基礎建設系統，依賴由更高階級的憑證中心發行給低階憑證中心的憑證，而層層構築而成的憑證鏈，來建立某個參與者的身份識別憑證的合法 性。這產生了不只一個電腦且通常涵蓋多個組織的憑證階層，涉及到多個來源軟體間的合作。因此公開的標準對公鑰基礎建設相當重要。這個領域的標準化多由 網際網路工程工作小組 （ IETF ）的 PKIX 工作群完成。 企業公鑰基礎建設通常和企業的資料庫目錄緊密結合，每個員工的公鑰內嵌在憑證中，和人事資料一起儲存。今日最先進的目錄科技是輕量目錄存取協定（ Lightweight Directory Access Protocol ， LDAP ）。事實上，最常見的憑證格式 X.509 的前身 X.500 是用於 LDAP 的前置處理器的目錄略圖。
• #33: VeriSign introduced the concept of classes of digital certificates: Class 1 for individuals, intended for email Class 2 for organizations, for which proof of identity is required Class 3 for servers and software signing, for which independent verification and checking of identity and authority is done by the issuing certificate authority Class 4 for online business transactions between companies Class 5 for private organizations or governmental security
• #52: 護照 是一個國家的政府发放給本國公民（ citizen ）或國民（ national ）的一種旅行证件，用於證明持有人的身分與國籍，以便其出入本國及在外國旅行，同時亦用於請求有關外國當局給予持照人通行便利及保護。 護照關係到在國外所受合法保護的權利與進入本籍國的權利。护照上通常有持有者的照片、签名、出生日期、国籍和其它个人身分的证明。许多国家正在開發將生物识别技术用於護照，以便能够更精确地确认护照的使用者是其合法持有人。 如今国际间旅行通常要求出示护照 , 但也有例外的情况。护照实际上仅仅是一种国际认可的用来对旅行者身份鉴定的手段。而这样的鉴定要求在很多情况下或针对某些旅行者可以免除。例如现在美国公民凭驾照即可进入墨西哥，而欧盟国民在欧盟内部旅行也不需要护照。 同样的，护照在一个国家内部也可以被当成身份证件而使用。